CVE-2021-35516

7.5 highEPSS 12%

High (7.5). EPSS 12% chance of exploitation in the next 30 days. Fixed in org.apache.commons:commons-compress 1.21.

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWEs: CWE-770, CWE-130
Published: 2021-07-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:commons_compress
netapp:active_iq_unified_manager
netapp:oncommand_insight
oracle:banking_digital_experience
oracle:banking_enterprise_default_management
oracle:banking_party_management
oracle:business_process_management_suite
oracle:commerce_guided_search
oracle:communications_billing_and_revenue_management
oracle:communications_cloud_native_core_automated_test_suite
oracle:communications_cloud_native_core_service_communication_proxy
oracle:communications_cloud_native_core_unified_data_repository
oracle:communications_diameter_intelligence_hub
oracle:communications_messaging_server
oracle:communications_session_route_manager
oracle:financial_services_crime_and_compliance_management_studio
oracle:financial_services_enterprise_case_management
oracle:flexcube_universal_banking
oracle:healthcare_data_repository
oracle:insurance_policy_administration
oracle:peoplesoft_enterprise_peopletools
oracle:primavera_unifier
oracle:utilities_testing_accelerator
oracle:webcenter_portal

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-crv7-7245-f45f	Maven	org.apache.commons:commons-compress	<1.21	1.21

References

Check your stack JSON